Wireless Pentesting Basics

Path 12's wireless-security lesson covered Wi-Fi attack concepts. This lesson covers how those concepts become a formal, scoped pentest activity — the specific tools and methodology for authorized wireless assessment.

Why wireless testing needs its own explicit scope

Directly connecting to the RoE-deep-dive lesson: wireless signals don't respect a building's walls the way wired network access does — a wireless assessment can easily, accidentally reach networks or devices genuinely outside the intended scope (a neighboring business's Wi-Fi, a passerby's personal device), making precise scoping and physical location awareness even more important than for purely wired testing.

Reconnaissance: mapping the wireless environment

Before attempting any attack, a wireless assessment starts with discovery — identifying every wireless network in range, its signal strength, its security configuration (WPA2/WPA3 vs. the broken WEP from Path 02), and, critically, distinguishing which access points genuinely belong to the authorized target versus neighboring, out-of-scope networks.

airodump-ng wlan0mon    # a common tool for wireless discovery and packet capture

Handshake capture and offline cracking

Directly extending Path 02's wireless-security lesson's brief mention: capturing the WPA2 authentication handshake — the initial exchange when a legitimate device joins the network — allows offline password-cracking attempts, using exactly the wordlist and brute-force concepts from Path 00's passwords lesson, without ever needing to interact with the live network again after capture.

Evil twin attacks, from the tester's side

Path 02 introduced evil twin attacks as a threat to defend against. In an authorized pentest, deploying a controlled evil twin access point (within explicit scope) tests whether employees can be lured onto a rogue network — directly connecting to the social-engineering-in-pentests lesson's phishing-simulation framing, applied to wireless specifically rather than email.

WPS vulnerabilities: a genuinely common real-world weakness

WPS (Wi-Fi Protected Setup), a feature meant to simplify connecting devices to a network, has well-documented cryptographic weaknesses in many implementations, sometimes allowing an attacker to recover a network's password through a brute-force attack against WPS's PIN mechanism specifically, entirely bypassing the strength of the actual WPA2 password itself — a genuinely important, often-overlooked finding to check for during a real assessment.

Enterprise wireless: 802.1X testing

Directly connecting to Path 12's network-access-control lesson: enterprise wireless networks using 802.1X authentication (rather than a single shared password) require different testing techniques entirely, focused on the authentication server configuration and certificate validation rather than password cracking — genuinely a different assessment approach than testing a standard home-style WPA2-Personal network.

Why does wireless testing require more careful physical scoping than wired network testing, even when both are technically authorized against the same organization?

Key terms

• Handshake capture — capturing the WPA2 authentication exchange for offline password-cracking attempts.
• WPS (Wi-Fi Protected Setup) — a network-joining convenience feature with well-documented cryptographic weaknesses in many implementations.

Recap

• Wireless pentesting requires especially careful physical scoping, since wireless signals don't respect the boundaries that make wired testing's scope relatively unambiguous.
• Handshake capture and offline cracking, evil twin deployment, and WPS vulnerability testing are the core techniques, each extending a concept Path 02 already introduced.
• Enterprise 802.1X wireless networks require an entirely different testing approach than standard WPA2-Personal networks, focused on authentication server and certificate configuration rather than password strength.

Next up → Purple Teaming Basics